Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file.

Mozilla Firefox before 3.0.15 and 3.5.x before 3.5.4, and SeaMonkey before 2.0, does not properly handle a right-to-left override (aka RLO or U+202E) Unicode character in a download filename, which allows remote attackers to spoof file extensions via a crafted filename, as demonstrated by displaying a non-executable extension for an executable file.

MozillaFirefox-50.1.0-1.1 on GA media

array index error in dtoa implementation of many products firefox: (rejected CVE-2009-1563) Firefox heap buffer overflow in string to number conversion Firefox: Predictable /tmp pathname use Firefox form history vulnerable to stealing Firefox crash in proxy auto-configuration regexp parsing Firefox heap buffer overflow in GIF color map parser XPCVariant:: VariantDataToJS() Firefox cross-origin data theft through document.getSelection() Firefox download filename spoofing with RTL override Firefox crashes with evidence of memory corruption Firefox crashes with evidence of memory corruption Firefox integer underflow in FTP directory list parser